C#: update MaD sink kinds by jcogs33 · Pull Request #13158 · github/codeql

jcogs33 · 2023-05-12T19:43:05Z

Description

This PR updates some C# MaD sink kind names in order to align across languages.
The following sink kind names are updated:

Old kind name	New kind name
`code`	`code-injection`
`sql`	`sql-injection`
`html`	`html-injection`
`xss`	`js-injection`
`remote`	`file-content-store`

Commit-by-commit review might be best.

(related Java PR: #12916)

Consideration

Let me know if any of the updates will be problematic for C# (especially the xss to js-injection and remote to file-content-store updates).
Let me know if I should add a change note. (I'm currently assuming it is not needed since C# custom data extensions are not in beta, but let me know if I should add a change note anyways.)

github-actions · 2023-05-12T19:45:37Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value
+ package,sink,source,summary,sink:code-injection,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql-injection,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value

github-actions · 2023-05-16T17:20:39Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value
+ package,sink,source,summary,sink:code-injection,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql-injection,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value

github-actions · 2023-05-16T17:26:10Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.rst:

-    System,"``System.*``, ``System``",25,12154,65,7
+    System,"``System.*``, ``System``",25,12154,65,3
-    Totals,,25,12717,397,7
+    Totals,,25,12717,397,3

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value
+ package,sink,source,summary,sink:code-injection,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html-injection,sink:remote,sink:sql-injection,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value

github-actions · 2023-05-16T18:10:36Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value
+ package,sink,source,summary,sink:code-injection,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:file-content-store,sink:html-injection,sink:js-injection,sink:sql-injection,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,,,
+ Dapper,55,,,,,,,,,,,55,,,,,,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,,28,,,,,,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,,6,,,,,,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,,48,,,,,,
- ServiceStack,194,,7,27,,,,,,75,92,,,,,,7,
+ ServiceStack,194,,7,27,,,,,75,,,92,,,,,7,
- System,65,25,12154,,8,8,9,,4,,33,3,1,17,3,4,10163,1991
+ System,65,25,12154,,8,8,9,,,4,3,33,1,17,3,4,10163,1991

michaelnebel

Thank you for doing this!

I think it makes sense to add a change note in case this is used by the field team.

github-actions · 2023-05-17T14:55:49Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

csharp

Generated file changes for csharp

Changes to framework-coverage-csharp.csv:

- package,sink,source,summary,sink:code,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:html,sink:remote,sink:sql,sink:xss,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value
+ package,sink,source,summary,sink:code-injection,sink:encryption-decryptor,sink:encryption-encryptor,sink:encryption-keyprop,sink:encryption-symmetrickey,sink:file-content-store,sink:html-injection,sink:js-injection,sink:sql-injection,source:file,source:file-write,source:local,source:remote,summary:taint,summary:value
- Dapper,55,,,,,,,,,,55,,,,,,,
+ Dapper,55,,,,,,,,,,,55,,,,,,
- Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,28,,,,,,,
+ Microsoft.ApplicationBlocks.Data,28,,,,,,,,,,,28,,,,,,
- Microsoft.EntityFrameworkCore,6,,,,,,,,,,6,,,,,,,
+ Microsoft.EntityFrameworkCore,6,,,,,,,,,,,6,,,,,,
- MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,,,
+ MySql.Data.MySqlClient,48,,,,,,,,,,,48,,,,,,
- ServiceStack,194,,7,27,,,,,,75,92,,,,,,7,
+ ServiceStack,194,,7,27,,,,,75,,,92,,,,,7,
- System,65,25,12154,,8,8,9,,4,,33,3,1,17,3,4,10163,1991
+ System,65,25,12154,,8,8,9,,,4,3,33,1,17,3,4,10163,1991

michaelnebel

Thank you!

michaelnebel · 2023-05-22T09:18:20Z

@jcogs33 : It is probably a good idea to run DCA before merging.

jcogs33 · 2023-05-25T18:38:58Z

@michaelnebel There were a few failures in the DCA run. Do those look like a cause for concern?

michaelnebel · 2023-05-26T08:55:43Z

@michaelnebel There were a few failures in the DCA run. Do those look like a cause for concern?

That is not related to your changes (looks like transient failures). The analyzed projects don't show any alerts diff - so I think you are changes are good to go :-)
Thank you for doing this for C#!

github-actions Bot added the C# label May 12, 2023

Jami Cogswell added 8 commits May 16, 2023 14:07

C#: update 'code' sink kind to 'code-injection'

613077c

C#: update 'sql' sink kind to 'sql-injection'

b6d011b

C#: update some test cases

f76563d

C#: update 'html' sink kind to 'html-injection'

a0b502f

C#: update 'xss' sink kind to 'js-injection'

74cd240

C#: update cwe-sink.csv file

d3da5a7

C#: update 'remote' sink kind to 'file-content-store'

06a28f6

C#: update CaptureSinkModels test case

588a62c

jcogs33 force-pushed the jcogs33/update-csharp-sink-kinds branch from 9d29820 to 588a62c Compare May 16, 2023 18:07

jcogs33 marked this pull request as ready for review May 16, 2023 18:48

jcogs33 requested a review from a team as a code owner May 16, 2023 18:48

michaelnebel reviewed May 17, 2023

View reviewed changes

Comment thread csharp/documentation/library-coverage/cwe-sink.csv

C#: add change note

be84fc2

github-actions Bot added the documentation label May 17, 2023

michaelnebel self-requested a review May 22, 2023 09:17

michaelnebel approved these changes May 22, 2023

View reviewed changes

jcogs33 merged commit 6867e94 into github:main May 26, 2023

jcogs33 deleted the jcogs33/update-csharp-sink-kinds branch May 26, 2023 12:03

This was referenced Jun 1, 2023

Java: add error message for outdated sink kinds in getInvalidModelKind #13228

Merged

Shared: share MaD kind validation across languages #13324

Merged

jcogs33 mentioned this pull request Jun 9, 2023

[CSharp] Additional data extensions for sink models #13093

Merged

Conversation

jcogs33 commented May 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Consideration

Uh oh!

github-actions Bot commented May 12, 2023

csharp

Generated file changes for csharp

Uh oh!

github-actions Bot commented May 16, 2023

csharp

Generated file changes for csharp

Uh oh!

github-actions Bot commented May 16, 2023

csharp

Generated file changes for csharp

Uh oh!

github-actions Bot commented May 16, 2023

csharp

Generated file changes for csharp

Uh oh!

michaelnebel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented May 17, 2023

csharp

Generated file changes for csharp

Uh oh!

michaelnebel left a comment

Choose a reason for hiding this comment

Uh oh!

michaelnebel commented May 22, 2023

Uh oh!

jcogs33 commented May 25, 2023

Uh oh!

michaelnebel commented May 26, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jcogs33 commented May 12, 2023 •

edited

Loading